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Elektrobit 


Agenda 


• Overview feature planning 

• Critical features 

- Shutdown performance 

- SW loading 

• Status performance 

• Application integration & test WS planning 
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Elektrobit 





ICAS1 Project status 


Elektrobit 


Current planning (Continental) 
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ICAS1 Project status 


Feature overview 


Feature overview 

30 
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Elektrobit 


Critical features with detailed overview 

• Shutdown performance 

- Reason: Early implementation required to mitigate the risk of the 
introduction 

• SW loading 

- Reason: Early implementation required to mitigate the risk of the 
introduction 
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ICAS1 Project status 


Elektrobit 


EB proposal: Features: Functional increase 


Features 

EB delivery 

Rebuild 

required 

Comments 

SW-EB-PM: error handling for corrupted database 
is missing 

0.21.1 (cw48/19) 

No 

Delivered 

Provisioning of UTC Time to Linux VMs as System 
Time 

0.23.1 (cw03/20) 

No 

Details in CR157 tracking overview 

CR157 - VW API support for Crypto API 

0.26.1 (cw08/20) 

Yes, if feature is used 

Details in CR157 tracking overview; on track as initially agreed 

VW Secure Storage Access Library support 

0.23.1 (cw03/20) 

Yes, if feature is used 

Details in CR157 tracking overview 

VW API for PSK and Backend TLS support 

0.26.1 (cw08/20) 

Yes, if feature is used 

Details in CR157 tracking overview; on track as initially agreed 

CR 233 MOD4 VKMS-Schlussel Housekeeping -Teil 

1 Schlussel fur MOD4 hinzufiigen 

0.23.1 (cw03/20) 

No 


VM UdpNM Message, the CRI bit is not active 

0.22.1 (cw50/19) 

No 

Delivered 

Software Loading via External Tester - SWCL 
Housekeeping, Adaptive, Java - Tooling 

0.25.1 (cw06/20) 

No 

See detailed plan 

Software Loading via External Tester - SWCL 
Housekeeping, Adaptive, Java 

0.25.1 (cw06/20) 

No 

See detailed plan 
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ICAS1 Project status 


Elektrobit 


EB proposal: Robustness and performance 


Features 

EB delivery 

Rebuild 

required 

Comments 

Multiple applications in container 

0.21.1 (cw48/19) 

Yes, if feature is used 

Delivered 

Support of Deadline Monitoring or Alive 

Supervision in adaptive SWCs 

0.26.x (cwl0/20) 

No 

Feature finished in 0.23.1 except for state manager. 

Planning for state manager to be confirmed due to shutdown 
performance. 

Support of Alive Supervision in 
AP-programming-Session 

0.25.1 (cw06/20) 

No 

Relevant only for SW update 

Monitoring of platform services 

0.25.1 (cw06/20) 

No 

Quality measures after delivery 

Startup performance 

0.25.1 (cw06/20) 

No 

Integration of new ViWi Proxy for descoped sSOA planned 
already for 0.23.1. 

Shutdown performance 

0.26.x (cwl0/20) 

Yes 

Technical concept in evaluation, planning in cw49 

IDS sensors (lower CPU load) 

0.25.1 (cw06/20) 

No 

Removal of ethtunnel confirmed 

eMMC_FlashProtection (EB) - eMMC Refresh 
Mechanism 

0.23.1 (cw02/20) 

No 

Identified during cw48 
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ICAS1 Project status 


Elektrobit 


EB proposal: Features: Security 


Features 

EB delivery 

Rebuild 

required 

Comments 

Rootfs shall be dm-verity protected 

0.23.1 (cw02/20) 

No 

Security feature, startup performance impact possible 

Security: Secure Storage in Linux (dm-integrity) 

0.25.1 (cw06/20) 

No 

Security feature, startup performance impact possible, initial 
implementation planned for 0.23.1 

Security: Linux file permissions 

0.25.1 (cw06/20) 

No 

Security feature 

Security: Linux Container Security 

0.23.1 (cw03/20) 

Yes, if feature should 
be effective 

Security feature 

Secure Booting of M3: R7 move to binary file 
format 

Planning in progress 

No 

Decision from Conti/VW required 

Core dump encryption 

0.26.1 (cw08/20) 

No 

Solution: turn off coredumps in production image 

OPTEE processes crytographic material in external 
RAM 

0.25.1 (cw06/20) 

Yes (only PnC) 

Modification of applications required to hold the keys in DRAM 
as short as possible 

EOL Kernel Functionality for Field return targets - 
Secure signing of EB installer images 

0.25.1 (cw06/20) 

No 

Moving to 0.25.1 required due to increased effort 

SW Secure Software Design Hypervisor 

0.25.1 (cw06/20) 

No 

Identified during cw48; necessity needs to be verified with 
security experts 
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Task force 

Shutdown performance 


Elektrobit 





I CAS 1; Project Status 


Elektrobit 


Timeline 


Shutdown 


Description 


Arc. design 


EB Impl. 


Step 11 NT EB 
base 


Conti Impl. 


Step 2 I NT 
EB-Conti 


Step 3 I NT 
EB-CN Apps 


VW app prp. 


Step 4 I NT 




App Note 
delivered 


CW02 

CW03 

CW04 

CW05 

CW06 

CW07 

CW08 

CW09 

CW10 





▼ 

0.23.1 



0.26.x 


Original TL still valid. Final delivery CW10. 

Application note jointly reviewed (Conti, VW, 3Ps) and released CW50.4. 
3P app integration to be clarified. 
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I CAS 1; Project Status 


Elektrobit 


Integration camp preparation 


Int. Camp 

Start 

Location 

SN-LIB 

m 

Linux 

> 

X 

tst App 

R7 PwrMng 

o 

EB Apps 

Conti Apps 

VW Apps 

Step 1: EB basic integration 

CW02.1 

ERL 

X 

X 

X 

X 

X 






Step 2: EB + Conti (RT-PowerManager) basic integration 

CW03.4 

ERL 


X 


X 


X 





Step 3: EB (all apps) + Conti (all apps) 

CWQ5.1 

ERL 


X 





X 

X 

X 


Step 4: EB + Conti + VW (apps) 

CW06.4 

ERL 


X 





X 



X 


- Learning from Step 3 EB/Conti app intetgration/test to be provided as guidence to VW/3P app teams. 

- Select 2 most critical VW applications to participate on site in ERL (critical = high amount and frequency of persistent 
data management). 

Al VW: please identify respective apps and request contacts/participants for integration camps. 

Note: Infrastructure prerequisites for app development, -build and -deployment of changes to be clarified with contact. 
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Optimize Shutdown/Restart - Open Issu 


Issue 


Delivery of Conti R7 
PowerManger 

Conti I nt e gration durations 

Platform architecture - 
rainy day scenarios 

ADG DM enhancements 

ADG UCM enhancements 

JAVA VM impacts 
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assumption 


latest 10.01.2020 
5 days 

Latest 17.12.2019 

No additional enhancements 
regarding „Keep alive logic" 

No enhancements are needed 


none of EB components are 
affected as Java needs to be 
handled by Conti/VW. 


Elektrobit 


owner 

due date for closing issue 

Conti: Victor Larie 

Cw50.5 -> Cw51.1 

Conti: John Bjorge / ? 

Cw50.5 

EB: Roland Guthaus 

Cw51.5 

EB: Paul Peter 

VW: Waldemar Knorr (?) 

CW50.5 -> CW51.3 

Confirmation from VW 
missing. 

EB: Moritz Neukirchner 
VW: Waldemar Knorr 

CW50.3 -> CW51.3 

Confirmation from VW 
missing. 

Conti: Vishnu Ralla/ 
Jean-Pierre Bogler 

Cw50.5-> CW51.1 
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Optimize Shutdown/Restart 


Elektrobit 


Status 


Step 

Name / Content 

Purpose 


Plan 

Actual 

0 

Application Documentation 

Application Note 


CW49.4 

CW49.4 

1 A5x basic Platform Integration Enabler for App i/f integration 0.23.1 CW03.3 

• Interface for Applications with StateNotificationLib (-> start 

• Basic State Manager step 2 int 

• Hypervisor CW03.4) 

2 

R-Car basic Integration 

• R7 PowerManager 

• Basic Platform 

R7 - A5x integration 


CW04.5 

t.b.c 
(-> start 
step 3 int 
CW05) 


3 

A5x Platform "FC" Integration 

EB Platform increment 0.25.1 CW06.3 

(-> start 
step 4 int 

CW6.4) 

• Linux 

• ADG 

• EB Apps 

• FC State Manager 

4 

A5x Platform „RfM" Integration 

Completion of EB Platform 
Completion of R-Car 

0.26.x 

CW10.4 


R-Car "RfM" Integrated 
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Taskforce 
SW loading 


Elektrobit 







ICAS1 Project status - SW update 


Elektrobit 


Feature development steps (milestones) 


Step 1:(SW0.21.1 and 0.22.1) 

• Basic SW Update "Feature": 

- Functionality to flash test container on VM's available 

Step 2: (SW0.23.1) 

• Functional standard update w/o „in field" dm verity 

- ECU Diag Precondition check 

- Complete PDX containers with Dev Key 

- Basic Emergency SW update support by 
AP_programming_session 

- SW-update coordination with R7 via shared memory 

- Downgrade protection support for eMMC emergency image 


Step 3:(0.25.1) 

• Feature finalization + stabilisation: 

- DM Verity (Infield key) 

- Full RFSv2.1 support Standard up 

- Error handling 

- Basic Emergency SW update support by 
AP_programming_session 

Step 4: (SWO.26.1) 

• Optimization and stabilisation 

- Early acknowledge (increase download speed) 

- FIAB-Reporting for invalid application 

• EB proposal: shift to ME2 to reduce the risk for the ME timeline 

- Based on meeting 19/12/09 joint decition to be done at a later point in 
time 
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Elektrobit 


Timeline/Status 


Legend: 


Coding 


duration 


Original 

Milestone 


Actual 


SW-Update 


▼ milestone 


Description 


CW50 


CW51 


CW52 


Feat. 


Step* 


Feat. Step 2 


Linux + HV 


Feat. Step3 


Feat. Step 3 


Feat. Step 


OTA-Client 


Workshop 


Tooling 




elease 

0.22.1 


DevDrop 

0.23.1 


Coding 


CW01 


Test Conti 


CW02 


Rel. Build 
0.23.1 


CW03 


Release 

0.23.1 


CW04 


CW05 


Dependent on previ¬ 
ous test results 





Rel. Candidate 
0.25.1 


CW06 

Release 

0.25.1 


Coding 


Coding+Bugfix+Stabi (0.25.1) 


Hotfix EB 



/K I 


Test EB 


CD 

+-> 

co 

|£ 

~o 

O 


Test Con; 


Test Conti 


Bugfix EB 


Conti/EB/Redbend 

Toulouse 



C 

QJ 

< b 

O CD 
_Q 
~o 

CD 

on 


Original timeline still valid. Final delivery SWO.25.1 (CW06/20) 

Timeline "Test Conti" not yet confirmed: Alignment meeting Tue. 17.12 

Actions (light blue) will be planned; execution and participants dependent on previous test results 
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Status Performance 


Elektrobit 





ICAS1 Project status 


Elektrobit 


Status Performance 


• Startup Performance 

- Critical Startup 

• Integrated complete image: VM_AO - DriverNotificationService 

• Platform Startup Outlook vom VM_JO 

- Overall Startup 

• CPU Load 


• ICAS1 Platform Performance Status 
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ICAS1 Project status 


Elektrobit 


Critical Startup Performance 

Integrated complete image: VM_AO - DriverNotificationService 


• VW Requirement 
DNH <= 5,5 seconds 


• VM_AO Startup Performance Forecast of 
DNH 


• DM verity not yet considered! 


• Marginal estimated improvement by 
container merge" -200ms is in 
contradiction to measured 0.21.1 
platform improvement of-800ms and has 
to be clarified 


Time [s] from clamp 30 until DriverNotification service 

■ Increase ■ Decrease ■ Total 



P074 measured 


- 0,2 


container merge 


5,5 _ 0,8 

- 0,8 

A075 estimated Remove DM Integrity 

sSOA 

enforcement 



5,5 



A080 estimate 
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Elektrobit 


Critical Startup Performance 

ICASl Platform Startup -VM JO 


• VW Requirement: 
TokenManager <= 15 seconds 


• VM_JO Startup Performance Forecast 

- Devdrop for new ARM core allocation shows 
positive results for KPI ^Platform Communication 
ready" ~11,6 seconds 


- TokenManager startup time of 15 seconds has to 
be confirmed by Conti 


ICASl EB Platform Startup Time Release devdrop ICAS1-13868 [msec] and delta to 0.21.1 delivery [msec] 


15.000 


u 

<u 

m 


10.000 

5.000 

0 


-5.000 


- 10.000 

-15.000 

- 20.000 



-25.000 


R7 Bootphase (ms) 


A5x.l VM-adaptive (ms) 
until sSOA enabled 
ARA::COM started 


A5x.2 VM-java (ms) until 
sSOA enabled ARA::COM 
started 


A5x.3 VM-housekeeping 
(ms) until sSOA enabled 
ARA::COM started 


■ delta to 0.21.1 delivery [msec] 


ICASl EB Platform Startup Time Release devdrop ICAS1- 
13868 [msec] 


-50 


212 


140 


-22.317 


219 


4.455 


11.581 


5.046 
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ICAS1 Project status 


Overall Startup 


• VW Requirement 
last application started <= 45 Seconds 


P074 


VM_AO 17,2 seconds 

VM_HK t.b.d. 

VM JO t.b.d. 
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Elektrobit 



P074_dltsvg 


A075 

A080 

t.b.d. 

t.b.d. 

t.b.d. t.b.d. 

t.b.d. 

t.b.d. 
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ICAS1 Project status 


CPU Load 


• VW Requirement: CPU Load <= 85% 

• Identification of high CPU consumers 

- Kswapd caused by memory leaks in ViWi_service_registry 

- ComServFlex 

• Various improvements are currently prototyped / already delivered 

- Optimization of ComServ Flex (Continental) 

- Removal of UdpNm (Continental) 

- Removal of ethtunnel (EB) 

- Provision of memcheck as binary instead of script (EB) 

• L074 + patches: measurements from Restbus-Simulation - 
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L074 + incl. ViWi service registry 
patch and memcheck binary 


VM_AO 

60% 

VM_HK 

90% 

VM_JO 

100% 




vm_adaptive 

120 
110 
100 
90 
80 
70 

# 60 
50 
40 
30 
20 
10 
0 

0 5,000 10,000 15,000 20,000 25,000 30,000 35,000 40,000 45,000 50,000 

seconds 22 

p- TOTAL CPU~%1 
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ICAS1 Project status 


Elektrobit 


Application integration & test WS planning - CR157 


• Pre-integration testing already 
established for CR157 Backend 
TLS content 


• Regular weekly sync meeting 
(Thursday) - EB, VW, IAV 



SYS JAVA 02 


VKMS Online 
DLC 
Client 


Trust Store 
Update 
Client 




Token 

Manager 

1 

Register 

& 

Pairing Client 


CSC MOD Package 



CSC Base Package 


Capability 
Cache aka 
Manifest MGR 


Alias 

Manager 
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ICAS1 Project status 


Elektrobit 


Application integration & test WS planning - CR157 


PoC 


Indep 

Incs 


TEE 

Cert 

Incs 


WPO: Pre-integration PoC 0 0 0 

o—o— 


ModDev 

W39/19 

W41/19 

TATU 

W40/19 

W41/19 


WP3.3a: Secure Storage 0 - 

o- 


-0-0—0 


0 0 




VKMS/TEE 

W41/19 

W46/19 

SAMS 

W45/19 

W49/19 

PjYTLI 

n/a 

n/a 




WP3.3b: Secure Storage with Access Policy •—i 

0-0- 

-fa WP2.1: Cert TLS HC certs 0 0 0 


o—o 


o- 


-o—o-o 




WP3.2a: TrustStorellpdate API 0“ 


☆ 


o- 


0 0 


-o- 


-0-0 


WP3.2b: ClientCertlnitializer API 0 - 

o- 

WP3.1: Key Authorization 




- 0—0 - 0 


(r 


0 


-0- 




| | | 


WP2.2a: Cert TLS / TEE certs 0 - 

0- 


t 


WP2.2b: Cert TLS / TEE certs 

" SSjK 


-# 


VKMS/TEE 

W47/19 

W49/19 

SAMS 


TBD 


TLS MGR 

W43/19 

W47/19 

VIMO 

W46/19 

W50/19 


ModDev 

W42/19 

W46/19 

TATU 


W48/19 


ModDev 

W45/19 

W51/19 

TATU 


W51/19 


ModDev 

W37/19 

W40/19 

TLS MGR 

W48/19 

W51/19 


■ 0 - 0—0 


Notes: 

• WP3.3a pre-INTE PASS today 

• WP2.1: pre-INTE started 

• WP3.3b& WP3.1: Ready for pre-INTE 
but dependency to 0.22.1 baseline & 
new CSC Containers 

• WP3.2b: pre-INTE start delayed by 1 
week (new DRAM/key wiping req) 

• WP2.2b: Everything known 
implemented along with WP2.1/2.2a; 
Pre-INTE window shortened to 1 week 


TLS MGR 

Completed by WP2.1 & 2.2a 

VIMO 

OK 1 OK 


ModDev 

W46/19 

W50/19 

TBD 




Notation used: 

Dev start Pre-INTE PASS 


Pre-INTE start 


Team#l 

Dev start 

INTE readiness 

Team#2 

Dev start 

INTE readiness 




• Black = Latest Estimate 

• Green = Actual 

• Red = Late 

Updated from last week 


© Elektrobit (EB) 2019 | Confidential information 


25 



























































































ICAS1 Project status 


Elektrobit 


Application integration & test WS planning 


CR157 


Pre-Integration flow 

J1 


= COMPONENT INTEGRATION IN ICAS1 TARGET 




Delivery flow 

i 


^2: EB / VW CSC Sync 

Integration scope 
Integration use cases 
Draft version ofWP 
increment Test Spec 


3: VW CSC Dev Start 

Modifications for the 
integration setup; e.g. 
modifying CSC Clients for 
integration; bypassing 
0CU4; etc. 




1: EB Dev start 

Req analysis /designs 
Development start in 
EB DEVBT Branch 


^ 7 

1 

^)EB ICAS1 SDK build 

• Based on EB_DEVBT 

Branch 

• Needed in the case of ADG 
version or API changes 
affecting VW CSC 

Containers 



5b: CSC Container build 

Building the Containers 
with the Clients and 
configurations required for 
integration 


6) Pre-INTE start 

Target flashing 
Transferring VW CSC 
Containers to target 
Test execution 


5a: EB_DEVBT target 
build 

• Target build to be used in 
the integration 


# © 




9) VW CSC Release 

Releasing Test Containers 
used in Pre-integration 


7) Pre-INTE PASS 

Releasing 
Test Spec update 



i - J • 

■-.i 


8) EB Release 

ICAS1 Product Release with 
SDK from EB_DEVBT 
Branch 



© = EB responsibility 
© = VW CSC responsibility 


Example Test I 
Spec draft: | \ 

Test Spec WP3.2a 
TrustStoreUpdate API 
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ICAS1 Project status 


Elektrobit 


Application integration & test WS planning - CR157 





- Toolchain 

• qemu image 

- platform image 


2c 





3 


PERFOMP image 


♦ 


1. CR157 artefacts delivery 

a. EB Platform (CORBOS) 
deliveries to Continental via 
PERFORCE 

b. VW-EB deliveries to 
Continental via Artifactory 

c. EB Platform (CORBOS) 
delivery to VW via Artifactory 


2. Perform input validation and 
smoke tests 

a. Fetch the dleiberies from 
Artifactory and place in 
Continental internal Repos 

b. Pre-int smoke tests 

c. Final ECU baseline 
integration (perfcompjmage) 

3. Integration and reduced 
system tests on Final image 
(perfcompjmage) 

4. Release the RCAR M3 
PERFCOMPJMAGE to VW via 
artifactory (Proper mainline 
baseline to be Flashed prior to 
flashing this image e.g J074) 





Streamlined Delivery 
Flow 
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ICAS1 Project status 


Elektrobit 


Application integration & test WS planning - ADG update 


• General proceeding for incompatible changes for application developers 

- Information meeting one week before the provision of release candidate 

• Performed for 0.21.1 on 2019-12-03 

• Goal: inform the application developers about upcoming changes relevant for application development 

• Agreement with Conti/VW from „Lieferantentag" 2019-12-02: use the established timeslot for „Adaptive Integration Meeting" Tue 9:00 

- Incoming inspection meeting - joint meeting between EB/Conti/application developers 2 days after provision of release candidate 

• Goal: provide feedback from application developers to EB from incoming inspection performed on the basis of the release candidate 

• Agreement with Conti/VW from „MOD-lntegrationsabsicherung" telco 2019-12-12, details to be clarified cw51 (content of incoming inspection) 

- Support during the adaptation of applications 

• Onsite support for 0.21.1 on 2019-12-05 - 2019-12-06 with positive feedback 

• Currently planned as online support for VW Infotainment @ Bochum after the provision of release build 

- Agreement with Conti/VW from „MOD-lntegrationsabsicherung" telco 2019-12-12 (follow-up from „Lieferantentag" 2019-12-02) 

• To be clarified: support for other applicaton developers 

- Proposal EB: joint onsite support @ VW Infotainment @ Bochum 
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Elektrobit 


Application integration & test WS planning - ADG update 


Incoming inspection meeting 

Information meeting 1 week before RC I Online support 


♦ _ ♦ _ ♦ 



Release - 

■5 

Release - 

■4 

Release - 

■ 3 Release■ 

-2 

Release -1 

Release 




1 

2 

3 

4 

5 

1 

2 

3 

4 

5 

1 

2 

3 

4 

5 

1 

2 

3 

4 

5 

1 

2 

3 

4 

5 

1 

2 

3 

4 

5 




































App. Development (3rd Party + internal 






RC 

ii 




RB 





RB 





























Dev. Phase 


Bugfix Looa 






















Q1 






33 













PreDev 








Rq 





RB 






RC 






















Pre-Eval Phase 






Bugfix Loop 











































Mainline 





RB 


SI 








RB 


SI 


51 






RB 


SI 


SI 








Freeze Build 1 

Rel. 




Freeze Build Rel. 




Freeze Build 1 

Rel. 




































SI 

System Integration 
























RC 

Release Candidate 
























RB 

Release Build 


























II 

Incoming Inspection 























Elektrobit 









Q1 (A. Fruechtl) 



IATtests passed + no blockers 

in DEV teams reported 

Development Teams 









Q3 (responsible TPL 

Test Vectors passed + no regression in SmokeTests 

AASR Pre-INT 

































System Integration 
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ICAS1 Project status 


Elektrobit 


Application integration & test WS planning - ADG update 


0.22.1 


0.23.1 


Information 

meeting 

0 

0 0 

Incoming inspection 
meeting 


0 

Support 

0 

0 


0.26.1 (t.b.c., MOD4 only) 

0 

0 


Q performed 
planned 


EB 0.22.1 
no rebuild 


EB Update 


EB 0.21.1 

rebuild needed 


EB 0.23.1 
rebuild needed 


EB 0.25.1 
no rebuild 


EB delivery line 
Adaptive 3rd party rebuild 


Pre-Dev Branch 



J 

\ 


|3rd party SW rebuild| 

1 

LU 

\ 

U 


3rd party SW rebuild 


Bug-fixes only 
4 a 5 S 


EB 0.25.x 


Continental dev-lines 

Platform RFM 


Test lines 

Shutdown 



ME2 content (to be detailed) 



Hug-fixes only 

. 11 yf. 

i4 A 

15 16*17 IS ' 


Stand KW4fi: KW10 = 100% Feature Complete ME + MOD4 (BSW only) 

Stand KW50: KW12 = 100% Feature Complete ME + MQD4 + Applications integrated 


1" 

L074 N074 |A075 (w. ADG update} \fijQ76 

4 L —* 

174 0074 

{woADGuftdete} 


t— i—i—i—i—i—i—r 


■A078 IA080 


AO90 ! AlOO 


1 i 

Last 3rd party feature 


Last 3rd party feature 

freeze for Flash 41 (A07B) 


freeze for Flash #2 (AOBB) 


Full validation test 


Full validation test 


[Full va idation test 


VW Industrialized SW 


rVW final tesrs ME homologation I +/W final test 


\VW Reflash Action #1 


Full validation test 

-► 


VW final test 


, Avw Reflash Action #2 

"V——- 
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Get in touch! 


Elektrobit 








